MiCoalesceFreePages

UINT64 __stdcall MiCoalesceFreePages(UINT64 PageBeingFreed){
  _MMPFN *PfnDb; 
  __int64 v2; 
  UINT64 v3; 
  signed __int64 v4; 
  UINT16 *v5; 
  unsigned __int64 v6; 
  unsigned int v7; 
  __int64 v8; 
  UINT64 v9; 
  int v10; 
  unsigned __int64 v11; 
  UINT8 *v12; 
  int v13; 
  int v14; 
  char *v15; 
  unsigned __int64 v16; 
  char *v17; 
  unsigned __int64 v18; 
  UINT64 v19; 
  _BYTE *v20; 
  _BYTE *v21; 
  unsigned __int64 v23; 
  _QWORD *v24; 
  UINT64 *v25; 
  unsigned __int64 v26; 
  unsigned int v27; 
  unsigned int v28; 
  __int64 v29; 
  unsigned int v30; 
  __int64 v31; 
  unsigned int v32; 
  __int64 v33; 
  unsigned int v34; 
  unsigned int v35; 
  unsigned int v36; 
  unsigned int v37; 
  unsigned int v38; 
  unsigned int v39; 
  bool v40; 
  int v41; 
  unsigned int v42; 
  __int64 v43; 
  CHAR v44; 
  int v45; 
  __int64 v46; 
  int v47; 
  INT64 v48; 
  unsigned int i; 
  unsigned __int64 v50; 
  INT64 v51; 
  __int64 v52; 
  WORK_QUEUE_TYPE v53; 
  PVOID v54; 
  __int64 v55; 
  INT64 v56; 
  INT64 v57; 
  INT64 v58; 
  int v59; 
  unsigned int v60; 
  unsigned int v61; 
  PVOID Lock; 
  UINT16 *v63; 
  INT64 a1[2]; 
  __int64 v65; 
  __int64 v66; 
  INT64 v67; 
  __int64 v68; 
  struct _IO_WORKITEM LockHandle; 
  memset(&LockHandle, 0, 24);
  if( !MmPhysicalMemoryBlock )
    return 0i64;
  PfnDb = MmGetPfnDb();
  v2 = (__int64)PfnDb + 48 * PageBeingFreed;
  v3 = PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64;
  v68 = v2;
  v67 = PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64;
  v60 = *(_BYTE *)(v2 + 34) & 7;
  v4 = 48 * (PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64);
  v5 = *(UINT16 **)(qword_140C4E388 + 8 * ((*(_QWORD *)(v2 + 40) >> 39) & 0x3FFi64));
  v63 = v5;
  v6 = (unsigned __int64)PfnDb + v4;
  v66 = (__int64)PfnDb + v4;
  v7 = 0;
  v8 = (__int64)PfnDb + v4 + 768;
  v9 = PageBeingFreed & 0xFFFFFFFFFFFFFFF0ui64;
  v10 = dword_140C4DBC8;
  v11 = v4 / 48;
  if( dword_140C4DBC4 > (unsigned int)dword_140C4DBC8
    || (v12 = &qword_140C4DC08[16 * dword_140C4DBC4], v11 < *(_QWORD *)v12)
    || dword_140C4DBC4 != dword_140C4DBC8 && v11 >= *((_QWORD *)v12 + 2) )
  {
    v13 = 0;
    if( dword_140C4DBC8 < 0 )
LABEL_103:
      KeBugCheckEx(0x1Au, 0x6201ui64, v11, 0i64, 0i64);
    while( 1 )
    {
      v14 = (v13 + v10) >> 1;
      v12 = &qword_140C4DC08[16 * v14];
      if( v11 >= *(_QWORD *)v12 )
      {
        if( v14 == dword_140C4DBC8 || v11 < *((_QWORD *)v12 + 2) )
        {
          dword_140C4DBC4 = (v13 + v10) >> 1;
          break;
        }
        v13 = v14 + 1;
      }
      else
      {
        if( !v14 )
          KeBugCheckEx(0x1Au, 0x6200ui64, v11, (ULONG_PTR)qword_140C4DC08, 0i64);
        v10 = v14 - 1;
      }
      if( v10 < v13 )
        goto LABEL_103;
    }
  }
  v61 = *((_DWORD *)v12 + 2);
  v15 = (char *)MmGetPfnDb() + 40;
  if( v6 != v8 )
  {
    v16 = v6 + 34;
    v17 = &v15[v4];
    do
    {
      if( v9 > 0xFFFFFFFFFi64 )
        return 0i64;
      if( ((*(_QWORD *)v17 >> 50) & 1) == 0 )
        return 0i64;
      v18 = *(_QWORD *)(v16 + 6);
      if( *(UINT16 **)(qword_140C4E388 + 8 * ((v18 >> 39) & 0x3FF)) != v5
        || (*(_BYTE *)v16 & 7u) > 1
        || (v18 & 0x1000000000i64) != 0 )
      {
        return 0i64;
      }
      v16 += 48i64;
      ++v9;
      v17 += 48;
    }
    while( v16 - 34 != v8 );
  }
  Lock = v5 + 96;
  v19 = v3;
  *(_OWORD *)&LockHandle.WorkItem.Parameter = 0i64;
  LODWORD(v20) = KeAbPreAcquire(v5 + 96, 0i64, 1ui64);
  v21 = v20;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)Lock, 17i64, 0i64)
    && !ExfTryAcquirePushLockShared((UINT64 *)Lock) )
  {
    if( v21 )
      KeAbPostReleaseEx(Lock, v21);
    return 0i64;
  }
  if( v21 )
    v21[26] |= 1u;
  v23 = v6;
  if( v6 == v8 )
    goto LABEL_49;
  v24 = (_QWORD *)((char *)MmGetPfnDb() + v4 + 40);
  while( 1 )
  {
    if( v23 == v2 )
    {
      v25 = (UINT64 *)(v23 + 16);
      if( (*(_BYTE *)(v23 + 34) & 7) != 0 )
        MiSetOriginalPtePfnFromFreeList(v25);
      else
        *v25 &= 0xFFFFFFFFFFFFFC1Fui64;
      goto LABEL_48;
    }
    if( v19 > 0xFFFFFFFFFi64
      || ((*v24 >> 50) & 1) == 0
      || *(UINT16 **)(qword_140C4E388 + 8 * ((*(_QWORD *)(v23 + 40) >> 39) & 0x3FFi64)) != v63
      || (*(_BYTE *)(v23 + 34) & 7u) > 1
      || _interlockedbittestandset64((volatile signed __int32 *)(v23 + 24), 0x3Fui64) )
    {
      goto LABEL_73;
    }
    if( (*(_BYTE *)(v23 + 34) & 7u) > 1 )
      goto LABEL_72;
    v26 = *(_QWORD *)(v23 + 40);
    if( *(UINT16 **)(qword_140C4E388 + 8 * ((v26 >> 39) & 0x3FF)) != v63
      || (*(_BYTE *)(v23 + 35) & 0x40) != 0
      || (v26 & 0x1000000000i64) != 0 )
    {
      goto LABEL_72;
    }
    if( !MiUnlinkFreeOrZeroedPage(v19, 0i64, 0i64) )
      break;
    ++*((_DWORD *)&LockHandle.WorkItem.Parameter + ((unsigned __int64)*(unsigned __int8 *)(v23 + 34) >> 6));
LABEL_48:
    v23 += 48i64;
    ++v19;
    v24 += 6;
    if( v23 == v8 )
      goto LABEL_49;
  }
  MiReturnFreeZeroPage(v23);
LABEL_72:
  _InterlockedAnd64((volatile signed __int64 *)(v23 + 24), 0x7FFFFFFFFFFFFFFFui64);
LABEL_73:
  if( v23 == v8 )
  {
LABEL_49:
    v27 = 0;
    v28 = 1;
    do
    {
      v29 = v7 + 1;
      v30 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v29);
      v31 = v7 + 2;
      v32 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v31);
      v33 = v7 + 3;
      v34 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v33);
      v35 = v30;
      v36 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v7);
      v37 = v32;
      v38 = v7;
      v39 = v36;
      if( v27 >= v36 )
        v39 = v27;
      if( v39 >= v30 )
        v35 = v39;
      if( v35 >= v32 )
        v37 = v35;
      v40 = v27 < v36;
      v27 = *((_DWORD *)&LockHandle.WorkItem.Parameter + v33);
      if( !v40 )
        v38 = v28;
      v28 = v7 + 3;
      if( v39 >= v30 )
        LODWORD(v29) = v38;
      if( v35 >= v32 )
        LODWORD(v31) = v29;
      if( v37 >= v34 )
        v28 = v31;
      v7 += 4;
      if( v37 >= v34 )
        v27 = v37;
    }
    while( v7 < 4 );
    v41 = v60;
    v42 = 0;
    v43 = v66;
    v44 = v28;
    if( v60 != 1 )
    {
      while( 1 )
      {
        v23 -= 48i64;
        if( MiPfnZeroingNeeded(v23, v28) )
          break;
        if( v23 == v66 )
          goto LABEL_80;
      }
      v60 = 1;
      v41 = 1;
    }
LABEL_80:
    v45 = 1;
    v59 = 1;
    if( v41 != 1 )
    {
      if( (unsigned int)MiColdPageSizeSupported() )
        v45 = 0;
      v59 = v45;
    }
    v46 = v66 + 720;
    v47 = 0;
    v48 = v66 + 720;
    for( i = 0; i < 0x10; ++i )
    {
      if( *(unsigned __int8 *)(v48 + 34) >> 6 != v28 )
      {
        MiChangePageAttribute(v48, v28, 1);
        v45 = v59;
      }
      if( !v45 )
      {
        v50 = *(_QWORD *)(v48 + 16);
        if( qword_140C4DC80 && (v50 & 0x10) == 0 )
          v50 &= ~qword_140C4DC80;
        if( HIDWORD(v50) != 4294967293 )
          v47 = 1;
      }
      *(_QWORD *)(v48 + 16) = 0i64;
      v48 -= 48i64;
    }
    v51 = v67;
    v65 = 0i64;
    a1[1] = v60;
    LODWORD(v58) = 1;
    LODWORD(v56) = v45;
    a1[0] = v67;
    v52 = *((_QWORD *)v63 + 2) + 4544i64 * v61;
    HIDWORD(a1[1]) = 2;
    LOBYTE(v65) = 17;
    MiInitializeAllResidentPageBasePfns(v63, v67, 16i64, 2i64, v44, v56, v58);
    LODWORD(v57) = 1;
    MiCreateInitialLargeLeafPfns(v67, 16i64, 2i64, v44, *v63, v57);
    LockHandle.WorkItem.List.Flink = 0i64;
    LockHandle.WorkItem.List.Blink = (_LIST_ENTRY *)(v52 + 4328);
    KxAcquireQueuedSpinLock(&LockHandle, (PIO_WORKITEM_ROUTINE)(v52 + 4328), v53, v54);
    v55 = v68;
    do
    {
      if( v46 == v43 )
        MiInsertLargePageInNodeList((INT64)a1);
      if( v46 != v55 )
        _InterlockedAnd64((volatile signed __int64 *)(v46 + 24), 0x7FFFFFFFFFFFFFFFui64);
      ++v42;
      v46 -= 48i64;
    }
    while( v42 < 0x10 );
    KeReleaseInStackQueuedSpinLockFromDpcLevel((_KLOCK_QUEUE_HANDLE *)&LockHandle);
    if( v47 )
      MiChangePageHeatImmediate(v51, 2i64, 0i64);
    MiReleasePushLockUnordered((volatile INT64 *)v63 + 24);
    return 1i64;
  }
  for( ; v6 < v23; v6 += 48i64 )
  {
    if( v6 != v2 )
    {
      MiReturnFreeZeroPage(v6);
      _InterlockedAnd64((volatile signed __int64 *)(v6 + 24), 0x7FFFFFFFFFFFFFFFui64);
    }
  }
  MiReleasePushLockUnordered((volatile INT64 *)Lock);
  return 0i64;
}

Referenced by:

MiInsertPageInFreeOrZeroedList